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MEMORANDUM FOR: Director of Central Intelligence 
VIA: General Counsel 


FROM: John F. Blake 
Deputy Director for Administration 


SUBJECT: Security Provisions in Agency Contracts 


REFERENCES: (a) Memo to DCI, dtd 1 Jun 78, fm DDA, , 
no subject (DD/A 78-2042/1) OSY/37eq 


(b) Memo to DDA, dtd 6 Jun 78, fm DCI, 
Subject: Contracting Procedures oy 
Security (ER 78-1465/3) OS8j/3°20/} 


1. Reference (a) was an update on the status of actions 
we are taking in the area of industrial security. Reference (b) 
indicated: your concern with the development of a "performance 
clause" which would subject a contractor to penalties in the 
event of a leak of security information. 


2. It appears that we are involved in uncharted waters 
when we attempt to use a penalty approach in Government contract- 
ing to enforce security requirements. While we can say with 
absolute certainty that a contractor is contractually required 
to meet al] the security requirements of his contract, the legal 
mechanisms to enforce performance have not been tested by Boards 
of Contract Appeals or in the Courts. The Office of General 
Counsel has found no cases in which a contract has been terminated 
for default based upon a violation of security. 


3. The legal bases for attributing the acts of an agent 
(employee) to his principal (contractor) are well established in 
Government contracting. If a contractor cumulatively fails to 
live up to the standard of duty required in: (1) the selection 
of the employee who is given access to classified information; 
(2) the method of training of that employee; (3) the method and 
character and intensity of supervision of that employee; and, 
(4) enforcement of the contractor's own policy and procedures 
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SUBJECT: Security Provisions in Agency Contracts 


with respect to handling classified material, his liability 
for the employee's actions can be affixed under the heading 
of either lack of good faith or willful misconduct. The 
burden of proof in this regard would be with the Covernment. 
Inasmuch es we approve the contractor's security procedures 
and grant approvals for persons to be given access te classi- 
fied data, the possibility for our shifting the tetal respon- 
sibility to the contractor for a breach ef contract for a 
security. violation by one of his exployees is rather rezote. 


4. Specific contract penalties, outside the very drastic 
step of ternination for default, are also difficult to assess. 
Tne Task Force on Industrial Security and Industrial Contracting 
in Reconmendation No. 17 of its Interim Report suggested "That 
incentive award fee type contracts include security performance 
along with other performance requirenents a3 a basis for fee 
determination.” This concept, which you approved, can be 
implemented to provide reward/penalty for various levels of 
contractor performance. While there are reasons other than 
profit on an instant contract which motivate a contractor to 
do a good job, a portion of an award fee, associated with 
security, could provide a meaningful incentive to a contractor. 
The rewards and penalties (profit and loss) thet a contractor 
earns on other than cost-plus-award-fee (CPAF) centracts are 
based on objective neasurerents in terms of cost, performance, 
and schedule. The intreduction of a subjective or even objec- 
tive measure for reward or penalty, based upon security, would 
probably not provice a neeningful incentive to a contractor 
unless a preponderance of fee or profit was associated with it. 
This then could become counterproductive to the incentive 
placed on operational and funding aspects of the contract. 

Such an incentive would also be difficult, if not impossible, 
to adrinister Gnd measure. 


5. Attached hereto is a proposed contract article entitled, - 

“Special Security Provisions” which highlights the importance 

we place on security in performance of the contract and sets 

forth the penalty a contractor is subject to in the event he 

fails to comply therewith. It should be noted that this article 
makes nore specific certain rights which are inherent in the 
“default” and “termination” provisions ef Governuent centracts. 
However, the article does incluie some languare which may £0 

too far in attributing the action of a contractor's ennloyee 
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SUBJECT: Security Provisions in Agency Contracts 


to the contractor. Because we are, in effect, creating new 
contract provisions and inserting language which is not a 
part of existing procurement regulations, we heve asked 
General Counsel to provide his comments on the enforceability 
and effectiveness of these provisions for your consideration, 
prior to implementation. Additionally, we should give con- 
Sideration to soliciting industry comments in orcer to test 


acceptance of our contractors, waich could possibly result in 
some beneficial sugrestions. 


16 JUN 1978 


John F. Blake 


' Att 
Distribution: 
Orig - DCI 
1 - DNCI 
1 - ER 
1 - OGC 
1 - D/Sec 
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SPECIAL SECURITY PROVISIONS 
ee ET RUN OLONG 


(a) The contractor shall maintain and administer, in = 
accordance with industrial security manuals and agreements 
incorporated with the schedule of this contract, a security 
Program which meets the requirements of these documents. 


(b) Reference is made to the article of the General 
Provisions entitled "Default" ("Termination"). It is agreed 
and understood that failure of the contractor to maintain and 
administer a security program, fully compliant with the 
Security requirements of this contract, constitutes grounds 
for termination for default. 


(c) Specifically, the contract is subject to immediate 
default, without the requirement of a 10-day cure notice, where 
it has been determined by the contracting officer. that failure 
to fully comply with the security requirements of the contract 
results from willful misconduct or lack of good faith on the 
part of any one of the contractor's directors or officers, or 
on the part of any of his managers, superintendents, or other 
equivalent representatives who have Supervision or direction of: 


(1) All or substantially all of the contractor's 
business, or 


(2) All or substantially all of the contractor's 
Operations at any one plant or separate location in 
which this contract is being performed, or 


(3) <A separate and complete major industrial 
Operation in connection with the performance of this 
contract. 


Reference is made to Article 24 of Section A of the General 
Provisions entitled "Non-Publicity." Violation of the: terms 
and conditions of this clause by any employee of the contractor 
constitutes a major breach of contract, and the contract may be 
terminated immediately for default without the requirement of 

a 10-day cure notice. 
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(d) Where deficiencies in the contractor's security 
program are noted, the contractor shall be provided a written 
notice of these deficiencies and given a period of 10 days to 
take corrective action. If the contractor fails to take the 
necessary corrective action, the Government may terminate the 
whole or any part of this contract for default. 


(e) The basis for the procedure (whether a 10-day notice 
is required or not) to be followed for termination of this 
contract under the provisions of this clause is a unilateral 
decision of the contracting officer and is not subject to the 
disputes clause of the contract. The factual basis upon which 
the default notice was issued is Subject to the disputes clause 
of the contract. 
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MEMORANDUM FOR: Director of Central Intelligence 


FROM: John F. Blake 
Deputy Director for Administration 


REFERENCE: Memo dtd 15 May 78 to DDA fm DET, 
no subject 


1. You asked about the Status of actions being taken 
". . . to get some teeth into our contracting procedures 
- + +." While there is work yet to be completed, I am 
able to report that much has been accomplished. 


2. <A directive was issued on 9 September 1977 to all 


of our contracting personnel requiring that security per- 
formance be considered aS a critical element in the con- 


of contractor Proposals and to develop a security check list 
for inclusion in requests for proposals. These actions will 
be completed by 16 June 1978, 


4. The Office of General Counsel (OGC) on 12 August 1977 
accepted the responsibility for Strengthening the security 
Clauses in our contracts. However, OGC subsequently advised 
that improved contract clauses in and of themselves would not 
solve the problem without developing greater precision and uni- 
formity in our industrial Security manuals. The responsibility 
for this rewrite of security manuals is scheduled for completion 
in August 1978 and has been assigned to the newly created 
Industrial Security Branch, Office of Security. I believe 
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5. In addition to the above efforts, action has been 
taken in other significant areas as follows: 


a. Letter from DCI to all Agency contractors 
who maintain classified intelligence information 
in their plants stressing the importance of security 
and need for involvement of senior corporate officials; 
b. A program of surprise industrial security 
audits and inspections of contractor facilities. 
A total of 25 surveys has been completed as of 
this date; ; 


c. Initiation of the polygraph program for 
key contractor employees; and 


d. Establishment of a suitability panel to 
review contractor clearances. . STATINTL 


6. I will keep you advised as actions are completed. 


eet 


yr 98 74 [#4 5 ohn F. Blake 
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15 MAY 1978 


MEMORANDUM FOR: Deputy Director for Administration 


FROM: Director of Central Intelligence 


I've lost the bubble on when we're going to get some teeth into 
our contracting procedures so that we can hold a contractor responsible 


for security lapses. 


STATINTL 
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6 JUN 1978 


MEMORANDUM FOR: Deputy Director for Administration 
FROM: Director of Central Intelligence 


SUBJECT: Contracting Procedures on Security 


1. I read your memo on the progress with inserting more security 
considerations into our contracting. Since then I have had one additional 
thought. 


2. You indicated that before we can modify the contracts themselves 
we have to clean up our security regulations to make them more explicit. 
That is certainly worth doing in any event. At the same time, I'm not 
sure that my primary objective in contracting is related to the security 
regulations we promulgate. What I am most specifically interested in is 
a "performance clause." What I have in mind is a clause that says if 
it is determined that security information has leaked out of the contractor's 
organization it is subject to penalties. This is not a question of whether 
he followed rules such as three combination safes and two locks on the 
doors, etc., but simply a question of whether there was a leak attributable 
to his operation. Clearly in the Boyce/Lee case this would have been 
operative. In many others, it would be difficult if not impossible to 
adjudicate responsibility. There would also be difficult issues as to 
whether the contractor is responsible for an employee who is too garrulous 
in a bar as opposed to the physical removal of classified data or equipment 
from his plant. I don't know how all of these would be worked out, but it 
seems to me consideration of this type of provision need not await a better 
definition of our security procedures. 
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